Feature: Plugin should support auth with MSI when running in Azure

[cschertz]

Goal is to minimize cred management

[briangann]

Can you explain this with a little more detail?

[cschertz]

For context https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Azure Managed Service Identity provides identities for VM and other resources types so they can be assigned roles in Azure and access to any resource that supports AAD Auth. Basically it is a managed service principal. When running on a VM in azure with MSI enabled instead of being passed a password to get an Auth Token a local endpoint on the VM is called to get the Auth token.

It would be great if the plugin had an MSI mode for auth. The overall goal being to get out of the business of credential management in code and config

Also i should add if i had the time right now to get caught up on grafana datasources i would work on the feature myself. I am happy to lend a hand with reviews and and feedback on any work that might get done

[Gabilehner]

Can you elaborate more on how this scenario will work?
Which resource do you see using MSI? Azure Data Explorer cluster? or do you want to access Azure Data Explorer with MSI authentication?

[srclosson]

Well defined, and a useful feature. I agree, getting credential management, while maintaining security seems to be a reasonable request.

@cschertz : any information you can attach to this issue wrt MSI etc. will help expidite things.

Thank-you

[cschertz]

Sorry i missed the previous request for more info. I

Can you elaborate more on how this scenario will work?
I expect the config for the plugin we be like 3 values. A flag indicating that MSI auth is being used. A flag indicating if the MSI is a user or system msi and then if user msi it would pass the user MSI info. If system MSI second value is not needed

Which resource do you see using MSI? Azure Data Explorer cluster? or do you want to access Azure Data Explorer with MSI authentication?
I want to access the ADX cluster with the MSI. So that we dont have another SP to manage credentials for.

[andresmgot]

This will be possible once #362 gets implemented.

[petegrimsdale]

Is there a timeline for when authentication using MSI in the datasource will be available ? This is already supported in the Azure Monitor datasource

[andresmgot]

@kostrse any feedback here?

[Gabilehner]

Not yet. @Sergey ***@***.***> - where do we stand with this work? Thanks, Gabi From: Andres Martinez Gotor ***@***.***> Sent: Tuesday, June 14, 2022 1:06 PM To: grafana/azure-data-explorer-datasource ***@***.***> Cc: Gabi Lehner ***@***.***>; Comment ***@***.***> Subject: Re: [grafana/azure-data-explorer-datasource] Feature: Plugin should support auth with MSI when running in Azure (Discussion #287) @kostrse<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fkostrse&data=05%7C01%7Cgabil%40microsoft.com%7C7e5efbca2cba4e0c1c0a08da4ded7a71%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637907979632396395%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=e1WnHd3AdkqTfy1dH2N6%2B4vS7%2B2IY4eQUJiUWanFNQk%3D&reserved=0> any feedback here? - Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fgrafana%2Fazure-data-explorer-datasource%2Fdiscussions%2F287%23discussioncomment-2945756&data=05%7C01%7Cgabil%40microsoft.com%7C7e5efbca2cba4e0c1c0a08da4ded7a71%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637907979632396395%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=2onuXPPr1pzzI8sWoORTKiixRc0%2FMS%2BqIz5bueWpIRA%3D&reserved=0>, or unsubscribe<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAJA5ZMYW5G2BKJJFXZSQWPDVPBKQLANCNFSM5YDLAFAQ&data=05%7C01%7Cgabil%40microsoft.com%7C7e5efbca2cba4e0c1c0a08da4ded7a71%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637907979632396395%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=w91FX0UQR4QTgOkwnViNPF4FRWrXLrvFpFgahT05iv4%3D&reserved=0>. You are receiving this because you commented.Message ID: ***@***.***>